Windows 11 incident KB5074109: How to manage login failures and recover your fleet

<# Fix-KB5074109-WinRE.ps1
Run inside WinRE / Recovery PowerShell.
This script performs OFFLINE servicing:
- Unlock BitLocker if needed
- Identify offline Windows volume
- Remove the RollupFix package matching 26100.7623 or 26200.7623 (KB5074109)
- Optionally apply KB5077744 offline via DISM Add-Package from CAB

Usage examples:
  powershell -ExecutionPolicy Bypass -File X:\Fix-KB5074109-WinRE.ps1 -RecoveryKey "111111-222222-..." -MsuPath "E:\KB5077744.msu"
  powershell -ExecutionPolicy Bypass -File X:\Fix-KB5074109-WinRE.ps1 -RecoveryKey "..." -CabPath "E:\Windows11.0-KB5077744-x64.cab"
#>

[CmdletBinding()]
param(
  # Optional BitLocker recovery key if the OS volume is locked
  [string]$RecoveryKey,

  # Optional: path to KB5077744 .msu (on USB or local WinRE drive letter)
  [string]$MsuPath,

  # Optional: path to extracted CAB (preferred if you already have it)
  [string]$CabPath,

  [switch]$WhatIfOnly
)

function Run([string]$File, [string[]]$Args) {
  Write-Host ">> $File $($Args -join ' ')" -ForegroundColor Cyan
  if ($WhatIfOnly) { return 0 }
  $p = Start-Process -FilePath $File -ArgumentList $Args -Wait -PassThru -NoNewWindow
  return $p.ExitCode
}

function Get-OffWinDir {
  # Find the drive that contains Windows\System32\config (offline registry hives)
  $drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Free -ge 0 }
  foreach ($d in $drives) {
    $cand = Join-Path $d.Root "Windows\System32\config"
    if (Test-Path $cand) {
      return (Join-Path $d.Root "Windows")
    }
  }
  throw "Offline Windows directory not found. Verify drive letters in WinRE."
}

function Get-OsBuildInfoOffline([string]$WinDir) {
  $hivePath = Join-Path $WinDir "System32\config\SOFTWARE"
  $tempKey = "HKLM\OFFSOFT"

  # Load hive
  $rc = Run "reg.exe" @("load",$tempKey,$hivePath)
  if ($rc -ne 0) { throw "Failed to load offline SOFTWARE hive. reg load exit code $rc" }

  try {
    $cv = Get-ItemProperty "Registry::$tempKey\Microsoft\Windows NT\CurrentVersion"
    return [pscustomobject]@{
      Build = [int]$cv.CurrentBuildNumber
      Ubr   = [int]$cv.UBR
      DisplayVersion = $cv.DisplayVersion
    }
  } finally {
    Run "reg.exe" @("unload",$tempKey) | Out-Null
  }
}

function Unlock-BitLockerIfNeeded([string]$WinDir, [string]$RecoveryKey) {
  # Determine drive letter of WinDir root
  $root = Split-Path $WinDir -Qualifier
  $drive = $root.TrimEnd('\')

  # If manage-bde exists in WinRE
  $manageBde = Join-Path $env:SystemRoot "System32\manage-bde.exe"
  if (-not (Test-Path $manageBde)) { return }

  # Check lock status
  $status = & $manageBde -status $drive 2>$null | Out-String
  if ($status -match "Lock Status:\s*Locked") {
    if (-not $RecoveryKey) { throw "OS volume ($drive) is locked. Provide -RecoveryKey to unlock BitLocker." }
    Write-Host "Unlocking BitLocker volume $drive with recovery key..." -ForegroundColor Yellow
    if (-not $WhatIfOnly) {
      & $manageBde -unlock $drive -RecoveryPassword $RecoveryKey | Out-Null
    } else {
      Write-Host "(WhatIf) manage-bde -unlock $drive -RecoveryPassword <key>"
    }
  }
}

function Find-RollupFixPackageName([string]$ImageRoot, [int[]]$Builds = @(26100,26200), [int]$Ubr = 7623) {
  # dism /image:<root> /get-packages /format:table
  $dism = Join-Path $env:SystemRoot "System32\dism.exe"
  if (-not (Test-Path $dism)) { throw "dism.exe not found in WinRE." }

  $args = @("/Image:$ImageRoot","/Get-Packages","/Format:Table")
  Write-Host "Querying packages..." -ForegroundColor Cyan
  $out = & $dism @args 2>&1 | Out-String

  # We want a line containing:
  # Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.7623.1.xx
  foreach ($b in $Builds) {
    $pattern = "Package_for_RollupFix~31bf3856ad364e35~amd64~~$b\.$Ubr\.1\.\d+"
    $m = [regex]::Match($out, $pattern)
    if ($m.Success) { return $m.Value }
  }

  return $null
}

function Remove-PackageOffline([string]$ImageRoot, [string]$PackageName) {
  $dism = Join-Path $env:SystemRoot "System32\dism.exe"
  Write-Host "Removing package: $PackageName" -ForegroundColor Yellow
  $rc = Run $dism @("/Image:$ImageRoot","/Remove-Package","/PackageName:$PackageName","/Quiet","/NoRestart")
  if ($rc -ne 0) { throw "DISM remove-package failed with exit code $rc" }
}

function Extract-CabFromMsu([string]$MsuPath, [string]$OutDir) {
  if (-not (Test-Path $MsuPath)) { throw "MSU not found: $MsuPath" }
  if (-not (Test-Path $OutDir)) { New-Item -ItemType Directory -Path $OutDir | Out-Null }

  # expand.exe is usually available
  $expand = Join-Path $env:SystemRoot "System32\expand.exe"
  if (-not (Test-Path $expand)) { throw "expand.exe not found in WinRE." }

  Write-Host "Extracting MSU to $OutDir ..." -ForegroundColor Cyan
  $rc = Run $expand @("-F:*",$MsuPath,$OutDir)
  if ($rc -ne 0) { throw "expand.exe failed with exit code $rc" }

  $cab = Get-ChildItem -Path $OutDir -Filter "*.cab" -ErrorAction SilentlyContinue | Select-Object -First 1
  if (-not $cab) { throw "No CAB found after extracting MSU. Check MSU contents." }
  return $cab.FullName
}

function Add-PackageOffline([string]$ImageRoot, [string]$CabPath) {
  if (-not (Test-Path $CabPath)) { throw "CAB not found: $CabPath" }
  $dism = Join-Path $env:SystemRoot "System32\dism.exe"
  Write-Host "Adding package (offline): $CabPath" -ForegroundColor Yellow
  $rc = Run $dism @("/Image:$ImageRoot","/Add-Package","/PackagePath:$CabPath","/Quiet","/NoRestart")
  if ($rc -ne 0) { throw "DISM add-package failed with exit code $rc" }
}

# ---------------- MAIN ----------------
$winDir = Get-OffWinDir
$root = Split-Path $winDir -Qualifier
$imageRoot = $root.TrimEnd('\')   # e.g. D:

Write-Host "Offline Windows detected at: $winDir (ImageRoot: $imageRoot)" -ForegroundColor Green

Unlock-BitLockerIfNeeded -WinDir $winDir -RecoveryKey $RecoveryKey

$os = Get-OsBuildInfoOffline -WinDir $winDir
Write-Host "Offline OS: Windows 11 $($os.DisplayVersion) — Build $($os.Build).$($os.Ubr)"

# Only target 26100/26200 and UBR 7623
if (@(26100,26200) -notcontains $os.Build) {
  Write-Host "Not target build (26100/26200). Exiting without changes." -ForegroundColor Green
  exit 0
}
if ($os.Ubr -ne 7623) {
  Write-Host "Not on UBR 7623. Exiting without changes." -ForegroundColor Green
  exit 0
}

$pkg = Find-RollupFixPackageName -ImageRoot $imageRoot
if (-not $pkg) {
  throw "Could not locate RollupFix package for build $($os.Build).7623 in offline image."
}

Remove-PackageOffline -ImageRoot $imageRoot -PackageName $pkg

# Optional: apply KB5077744 offline (recommended)
if ($CabPath -or $MsuPath) {
  $cabToUse = $CabPath
  if (-not $cabToUse) {
    $tmp = Join-Path $env:TEMP "KB5077744_EXTRACT"
    $cabToUse = Extract-CabFromMsu -MsuPath $MsuPath -OutDir $tmp
  }
  Add-PackageOffline -ImageRoot $imageRoot -CabPath $cabToUse
  Write-Host "Offline fix package applied. Reboot to finalize." -ForegroundColor Green
} else {
  Write-Host "Rollback done. No OOB applied (no -MsuPath/-CabPath provided). Reboot, then apply KB5077744 online ASAP." -ForegroundColor Yellow
}

Write-Host "Done. Reboot the device." -ForegroundColor Green
exit 0